Remix.run Logo
▲ EGreg 4 hours ago

This is huge. It means the Bitcoin and Ethereum communities can now confidently ship the opcodes and precompiled contracts to check ECDSA signatures on P-256 in addition to K-256 curves, and stop worrying about possible NSA backdoors based on the chosen seeds (quantum computers are another story).

I turned out to be right in my advocacy years ago, here is my post: https://ethereum-magicians.org/t/eip-7212-precompiled-for-se...

▲tptacek 4 hours ago | parent | next [-]

Nobody conversant with elliptic curve cryptography research believed there was a backdoor based on these seeds; for a number of reasons, best articulated by Koblitz and Menezes (who took on the question directly).

But it's nice to be able to shut the whole unproductive debate down directly.

▲ReptileMan 4 hours ago | parent [-]

But what if there is a backdoor and just looped the RNG until they find the seeds that will match it. Just in case. /s

▲jerf 4 hours ago | parent [-]

Taking the question seriously (when I wrote this there was no /s), since I think it is still a question some people legitimately have, it is still extremely implausible that such tight dates and such a small number of iterations are all backdoored. For backdoors to be that dense would indicate some sort of serious flaw in the algorithm as a whole as well, something so serious that it should be fairly obvious. If these were initialized from dates, each separated by some billions of years and with the iteration parameters also in the millions or billions or trillions for no apparent reason it would be time to be suspicious.

Is it impossible? It is hard to prove impossible. But this is not what I would expect backdoors to look like.

In fact this makes me think that the information about how these were generated must have been lost very early in the process, or over-compartmentalized away from the wrong people. It seems like the NSA should have been positively delighted to show that these were the origins of the seeds as they are decent "nothing up my sleeve" numbers: https://en.wikipedia.org/wiki/Nothing-up-my-sleeve_number Advertising that fact should have been advantageous to the NSA if that is indeed how they were generated, so my best guess is that the parts of the NSA that should have been showing us that must not have themselves known.

▲clipsy 4 hours ago | parent | prev [-]

If there’s one thing everyone knows about conspiracy theorists, it’s that they’re willing to accept concrete disproof of their theories. /s